插件2.0上线

pmiaowu · Nov 30, 2021 · 036db62 · 036db62
1 parent 22b48b3
commit 036db62
Show file tree

Hide file tree

Showing 60 changed files with 2,333 additions and 1,224 deletions.
diff --git a/.gitignore b/.gitignore
@@ -1,5 +1,8 @@
 .idea
 .DS_Store
+.settings
+.classpath
+.project
 out
 target
-/src/main/java/META-INF/MANIFEST.MF
+BurpFastJsonScan.imi
diff --git a/BurpFastJsonScan.iml b/BurpFastJsonScan.iml
diff --git a/Docs/images/1.png b/Docs/images/1.png
diff --git a/Docs/images/10.png b/Docs/images/10.png
diff --git a/Docs/images/11.png b/Docs/images/11.png
diff --git a/Docs/images/12.png b/Docs/images/12.png
diff --git a/Docs/images/13.png b/Docs/images/13.png
diff --git a/Docs/images/14.png b/Docs/images/14.png
diff --git a/Docs/images/2.png b/Docs/images/2.png
diff --git a/Docs/images/3.png b/Docs/images/3.png
diff --git a/Docs/images/4.png b/Docs/images/4.png
diff --git a/Docs/images/5.png b/Docs/images/5.png
diff --git a/Docs/images/6.png b/Docs/images/6.png
diff --git a/Docs/images/7.png b/Docs/images/7.png
diff --git a/Docs/images/8.png b/Docs/images/8.png
diff --git a/Docs/images/9.png b/Docs/images/9.png
diff --git a/README.md b/README.md
@@ -1,63 +1,73 @@
 # BurpFastJsonScan
 一款基于BurpSuite的被动式FastJson检测插件
 
-# 自言自语
-据听说它的诞生是因为作者在实际项目由于不够细
+# 重点
+该插件只授权于企业内部进行问题排查，请勿用于非法用途，请遵守网络安全法，否则后果作者概不负责
 
-没有每个json都尝试进行一次fastjson的漏洞检测
+该插件只授权于企业内部进行问题排查，请勿用于非法用途，请遵守网络安全法，否则后果作者概不负责
 
-导致差点错过了三个目标靶向，好在同事够细!!! :)
+该插件只授权于企业内部进行问题排查，请勿用于非法用途，请遵守网络安全法，否则后果作者概不负责
 
-作者事后后悔不已
+该插件只授权于企业内部进行问题排查，请勿用于非法用途，请遵守网络安全法，否则后果作者概不负责
 
-于是乎～
+该插件只授权于企业内部进行问题排查，请勿用于非法用途，请遵守网络安全法，否则后果作者概不负责
 
-它就诞生了
+该插件只授权于企业内部进行问题排查，请勿用于非法用途，请遵守网络安全法，否则后果作者概不负责
 
 # 简介
 BurpFastJsonScan 一个希望能节省一些渗透时间好进行划水的扫描插件
 
-该插件会对BurpSuite传进来的每个不同的域名+端口的json流量进行一次fastjson dnsLog出网检测
+该插件会对BurpSuite传进来的带有json数据的请求包进行检测
 
 目前的功能如下
-- dnsLog出网检测(由于使用的是恶意payload所以能出来基本上该站就死了)
+- 命令回显
+- 远程命令执行
 
 # 编译方法
+
+<details>
+<summary><b>编译方法</b></summary>
+
 这是一个 java maven项目
 
-打开: /BurpFastJsonScan/pom.xml
-![](./Docs/images/1.png)
-安装完对应的包以后
+java版本为 1.8
+
+导入idea,打开刚刚好下载好的源码
+
+![](./images/1.png)
+
+打开: /BurpFastJsonScan/pom.xml 安装对应的包,第一次安装依赖包需要比较久,慢慢等不要急
+
+![](./images/2.png)
+
+![](./images/3.png)
+
+编译文件地址: /BurpFastJsonScan/target/BurpFastJsonScan/
+
+jar包地址: /BurpFastJsonScan/target/BurpFastJsonScan/BurpFastJsonScan.jar
 
-![](./Docs/images/2.png)
-![](./Docs/images/3.png)
-![](./Docs/images/4.png)
-![](./Docs/images/5.png)
-![](./Docs/images/6.png)
-![](./Docs/images/7.png)
+项目配置文件地址: /BurpFastJsonScan/target/BurpFastJsonScan/resources/config.yml
 
-编译文件地址: BurpFastJsonScan/out/artifacts/BurpFastJsonScan_jar/BurpFastJsonScan.jar
-![](./Docs/images/8.png)
 接着拿着这个jar包, 导入BurpSuite即可
 
+</details>
+
 # 安装方法
 这是一个 java maven项目
 
 如果你想自己编译的话, 那就下载本源码自己编译成 jar包 然后进行导入BurpSuite
 
-如果不想自己编译, 那么下载该项目提供的 jar包 进行导入即可
-
-![](./Docs/images/9.png)
+![](./images/8.png)
 
-![](./Docs/images/10.png)
+![](./images/9.png)
 
-![](./Docs/images/11.png)
+![](./images/10.png)
 
 # 检测方法选择
 
-目前有一种方法进行的检测
-
-1. dnsLog
+目前有二种方法进行的检测
+- 命令回显
+- 远程命令执行
 
 # 检测规则
 
@@ -66,15 +76,13 @@ BurpFastJsonScan 一个希望能节省一些渗透时间好进行划水的扫描
 - POST 的参数内容为json
 - Cookie 的参数内容为json
 
+```
 例子:
-
 GET, POST, Cookie 有个参数 json
-
 json = {"aaa":"66666"}
-
 那么就会去检测
-
 json的这种就是请求包的内容直接就是json不带参数的那种, 也会去检测
+```
 
 # 使用方法
 我们正常去访问网站, 如果站点的某个请求出现了 json 那么该插件就会去尝试检测
@@ -90,26 +98,36 @@ json的这种就是请求包的内容直接就是json不带参数的那种, 也
 
 目前有这几个地方可以查看
 
-![](./Docs/images/12.png)
-![](./Docs/images/13.png)
-![](./Docs/images/14.png)
+![](./images/4.png)
+![](./images/5.png)
+![](./images/6.png)
 
 # tag界面查看漏洞情况
 
 现在可以通过tag界面查看漏洞情况了
 
 分别会返回
+- request no json =  请求没有json
+- request json no eligible = 请求json不符合条件
+- the number of website problems has exceeded = exceeded 超出网站问题的数量
+- the number of website scans exceeded = 超出网站可扫描次数
+- waiting for test results = 等待测试结果
+- \[+\] found fastJson command execution = 查找到fastJson命令执行
+- \[-\] not found fastJson command execution = 没有查找到fastJson命令执行
+- \[x\] scan task timed out = 扫描任务超时
+- \[x\] unknown error = 未知的错误
+
+当发生 unknown error 的时候,可以尝试在下方中查看错误详情
 
-- waiting for test results = 扫描中
-- fastJson scan task timeout = 扫描任务超时
-- fastJson scan unknown error = 扫描发生未知错误
-- [-] not found fastJson = 没有扫描出使用了 fastJson
-- [+] found fastJson = 使用了 fastJson 并且出网
+![](./images/7.png)
 
-发生 fastJson scan unknown error 的时候
+# 疑难杂症解决
 
-可以先看看是否可以正常访问 http://www.dnslog.cn/ 这个站点, 如果不行的话, 就换一个可以访问 http://www.dnslog.cn/ 的wifi
+假如扫描出问题了,想要重新扫描怎么办?
 
-接着可能就是waf拦截的问题, 毕竟发的是有害的payload, 有waf拦截也是没办法的事情
+例如tag一直出现如下问题:
+- the number of website problems has exceeded = exceeded 超出网站问题的数量
+- the number of website scans exceeded = 超出网站可扫描次数
 
-注意: 发生异常错误的时候,不用担心下次不会扫描了,下次访问该站点的时候依然会尝试扫描,直到扫描完毕为止
+解决方案:
+![](./images/11.png)
diff --git a/images/1.png b/images/1.png
diff --git a/images/10.png b/images/10.png
diff --git a/images/11.png b/images/11.png
diff --git a/images/2.png b/images/2.png
diff --git a/images/3.png b/images/3.png
diff --git a/images/4.png b/images/4.png
diff --git a/images/5.png b/images/5.png
diff --git a/images/6.png b/images/6.png
diff --git a/images/7.png b/images/7.png
diff --git a/images/8.png b/images/8.png
diff --git a/images/9.png b/images/9.png
diff --git a/pom.xml b/pom.xml
@@ -4,35 +4,104 @@
          xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">
     <modelVersion>4.0.0</modelVersion>
 
-    <groupId>org.example</groupId>
+    <groupId>org.pmiaowu</groupId>
     <artifactId>BurpFastJsonScan</artifactId>
-    <version>1.0-SNAPSHOT</version>
-    <build>
-        <plugins>
-            <plugin>
-                <groupId>org.apache.maven.plugins</groupId>
-                <artifactId>maven-compiler-plugin</artifactId>
-                <configuration>
-                    <source>6</source>
-                    <target>6</target>
-                </configuration>
-            </plugin>
-        </plugins>
-    </build>
+    <version>2.0.0</version>
 
     <dependencies>
         <!-- https://mvnrepository.com/artifact/net.portswigger.burp.extender/burp-extender-api -->
         <dependency>
             <groupId>net.portswigger.burp.extender</groupId>
             <artifactId>burp-extender-api</artifactId>
-            <version>1.7.22</version>
+            <version>2.3</version>
+        </dependency>
+
+        <!-- https://mvnrepository.com/artifact/com.github.kevinsawicki/http-request -->
+        <dependency>
+            <groupId>com.github.kevinsawicki</groupId>
+            <artifactId>http-request</artifactId>
+            <version>6.0</version>
         </dependency>
 
-        <!-- https://mvnrepository.com/artifact/org.apache.httpcomponents/httpclient -->
+        <!-- https://mvnrepository.com/artifact/org.yaml/snakeyaml -->
         <dependency>
-            <groupId>org.apache.httpcomponents</groupId>
-            <artifactId>httpclient</artifactId>
-            <version>4.5.12</version>
+            <groupId>org.yaml</groupId>
+            <artifactId>snakeyaml</artifactId>
+            <version>1.29</version>
         </dependency>
     </dependencies>
+
+    <build>
+        <plugins>
+            <plugin>
+                <groupId>org.apache.maven.plugins</groupId>
+                <artifactId>maven-compiler-plugin</artifactId>
+                <version>3.8.1</version>
+                <configuration>
+                    <source>1.8</source>
+                    <target>1.8</target>
+                    <encoding>UTF-8</encoding>
+                </configuration>
+            </plugin>
+            <plugin>
+                <groupId>org.apache.maven.plugins</groupId>
+                <artifactId>maven-assembly-plugin</artifactId>
+                <version>3.3.0</version>
+                <configuration>
+                    <!-- 自定义jar包名称 -->
+                    <finalName>BurpFastJsonScan</finalName>
+                    <appendAssemblyId>false</appendAssemblyId>
+                    <archive>
+                        <manifest>
+                            <mainClass>burp.BurpExtender</mainClass>
+                        </manifest>
+                    </archive>
+                    <descriptorRefs>
+                        <descriptorRef>jar-with-dependencies</descriptorRef>
+                    </descriptorRefs>
+                    <outputDirectory>
+                        ${project.build.directory}/BurpFastJsonScan
+                    </outputDirectory>
+                </configuration>
+                <!-- 添加此项后，可直接使用mvn package | mvn install -->
+                <!-- 不添加此项，需直接使用mvn package assembly:single -->
+                <executions>
+                    <execution>
+                        <id>make-assembly</id>
+                        <phase>package</phase>
+                        <goals>
+                            <goal>single</goal>
+                        </goals>
+                    </execution>
+                </executions>
+            </plugin>
+            <plugin>
+                <groupId>org.apache.maven.plugins</groupId>
+                <artifactId>maven-resources-plugin</artifactId>
+                <version>3.2.0</version>
+                <executions>
+                    <execution>
+                        <id>copy-resources</id>
+                        <phase>package</phase>
+                        <goals>
+                            <goal>copy-resources</goal>
+                        </goals>
+                        <configuration>
+                            <outputDirectory>${project.build.directory}/BurpFastJsonScan/resources</outputDirectory>
+                            <resources>
+                                <resource>
+                                    <directory>src/main/resources</directory>
+                                    <includes>
+                                        <exclude>**/*</exclude>
+                                    </includes>
+                                    <filtering>true</filtering>
+                                </resource>
+                            </resources>
+                            <encoding>UTF-8</encoding>
+                        </configuration>
+                    </execution>
+                </executions>
+            </plugin>
+        </plugins>
+    </build>
 </project>